Fakin[.]The[.]Funk[.]4[.]1[.]0[.]146[.]Port[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Fakin.The.Funk.4.1.0.146.Port.exe
Size

24.0MB
MD5

aa9e7344cfae8b655b17e6ef3911b00f
SHA1

473c29a677804e9024f6d45b21c720cc92717190
SHA256

c055632a4741530aaceda0a2d49e7228000bc3876e02e91cd3b5fdddd5ad056b
SHA512

8c49992d965cfe45e93aeb40243a15c2fb37ca5555d1343dac290745c71a38c1fa01ebd0c850437c15fcf32512c45781b6c55f0c4944a751403e7626a79eee1b
SSDEEP

196608:9Dqt0/hi4wo1hJps6pSgCgIhLa5WSEFgS+cdOy5peJsMF+WdoU3xNtIv32YvBOWO:IonJps6pSgdxEKS1dONLo4rtq32Yva

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fakin.The.Funk.4.1.0.146.Port.exe

Files

Fakin.The.Funk.4.1.0.146.Port.exe
.exe windows x86

6080bfe3235cf25f8aae61b780e07a41

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
GetModuleHandleW
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
IsWow64Process
OpenProcess
GetLastError
DuplicateHandle
GetCommandLineW
OpenFileMappingW
MapViewOfFile
SetEvent
UnmapViewOfFile
CloseHandle
GetCommandLineA
CreateFileW
CreateFileMappingW
GetFileSizeEx
VirtualAlloc
VirtualFree
LoadLibraryW
ExitProcess
GetModuleHandleA

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 19.2MB

.idata
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ